{
 "schema_version": "0.4",
 "id": "REG-0032",
 "title": "Archon: control API (application programming interface), with its identity check off by default and open on all network interfaces, lets anyone who can reach it send instructions to an AI coding agent that runs without permission prompts; the CVE (Common Vulnerabilities and Exposures) record says this runs host commands, the reporter says that is not established; published 15 October 2026, no fix named",
 "batch": "agent-2026-10-16",
 "family": "software",
 "context": {
  "domain": "Software agent (AI coding agent operated through Archon's server and /api/* control API)",
  "autonomy_level": "alone",
  "autonomy_level_text": "The coding agent runs in bypassPermissions mode, which Archon's security page says lets it read, write and execute files and run shell commands with no per-action confirmation step; it acts on messages received over the control API",
  "actor_type": "Software: the AI coding agent run by Archon 0.2.13 through 0.11.1",
  "actors": {
   "count": 1,
   "text": "1 agent; attacker as an unauthenticated caller with network access to the control API",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure found by reading Archon's source code at v0.11.1; the reporter sent no requests to a running instance; no exploitation reported",
  "jurisdiction": [
   "Global (open-source project)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "CVE record assigned by VulnCheck and recorded in NVD; corroborated by Archon's own security page and code, which show the identity check off by default and the agent running without per-action confirmation; host command execution is disputed by the reporter; no maintainer advisory or fix",
 "status": "confirmed",
 "status_text": "Confirmed (corroborated by Archon's own documentation and code; host command execution disputed; no fix; no exploitation reported)",
 "outcome": {
  "state": "pending",
  "severity": "none reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "21 Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "The AI coding agent run by Archon 0.2.13 through 0.11.1, which runs with bypassPermissions",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-111322",
    "CVE-111322"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "Messages sent to the AI coding agent through the /api/* control API by an unauthenticated attacker with network access; the API binds to 0.0.0.0 by default",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-111322",
    "CVE-111322"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-111322",
    "CVE-111322",
    "HACKMD",
    "ARCHON-SEC"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step'",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322",
    "CVE-111322",
    "HACKMD",
    "ARCHON-SEC"
   ],
   "confidence": "medium",
   "disputed": true
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: pending (no fix has shipped). No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322",
    "CVE-111322",
    "HACKMD"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "CVE-2026-111322, assigned by VulnCheck as CVE Numbering Authority (reserved and published 15 October 2026); weakness CWE-306 (Common Weakness Enumeration: Missing Authentication for Critical Function); VulnCheck's severity scores CVSS (Common Vulnerability Scoring System) version 4.0 9.3 and version 3.1 9.8, which the National Vulnerability Database lists as VulnCheck's without scoring the record itself (status Deferred); affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn, whose write-up of 14 October 2026 reviewed the source at v0.11.1 and states 'Runtime validation was NOT performed'; the US Cybersecurity and Infrastructure Security Agency's enrichment of 16 October 2026 rates exploitation 'poc' (proof of concept)",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-111322",
    "CVE-111322",
    "HACKMD"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-111322",
    "CVE-111322",
    "ARCHON-0121"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-111322",
    "CVE-111322"
   ],
   "confidence": "low",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established, that what a driven run does depends on the workflows and agent configured, and that turning on web authentication makes the finding not apply, while binding to the local machine only removes the network reach. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
  "source_ids": [
   "NVD-111322",
   "HACKMD",
   "ARCHON-SEC",
   "ARCHON-0121"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [],
  "succeeded": [],
  "absent": [
   {
    "id": "C-A1",
    "note": "Mechanism: in a default install the /api/* control API passes messages, workflow runs and approvals for the coding agent from any caller with network access without checking identity; the gate that would check is on only when DATABASE_URL and BETTER_AUTH_SECRET are both set. Why it interrupts: the reporter says that with that gate on, other routes return 401 (unauthorised) and 'In that configuration the finding does not apply'. Source shows it absent: the CVE record states missing authentication (CWE-306, Common Weakness Enumeration: Missing Authentication for Critical Function) on the control API, and the reporter quotes the code `if (!isApiGateEnabled()) return next();`.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-E3",
    "note": "Mechanism: the agent acts on received messages in bypassPermissions mode. Why it interrupts: a confirmation step before an action would put a human decision between the attacker's message and the action; no source shows this counterfactual, and the reporter notes that workflow approval gates, where a workflow has them, can themselves be approved by the same unauthenticated caller, so such a step would interrupt only if its approval were authenticated. Source shows it absent: Archon's security page says the agent can 'read, write, and execute files without interactive confirmation prompts' and 'There is no per-action confirmation step'; the CVE record names the bypassPermissions mode.",
    "confidence": "medium",
    "basis": "agent"
   }
  ]
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "Archon",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null
   }
  }
 ],
 "sources": {
  "NVD-111322": {
   "title": "NVD record CVE-2026-111322: Archon 0.2.13 through 0.11.1 missing authentication on the /api/* control API, coding agent with bypassPermissions executes host commands",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111322",
   "date": "2026-10-15",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-16"
  },
  "CVE-111322": {
   "title": "CVE record CVE-2026-111322 (assigner VulnCheck) as mirrored by ThreatINT: dates, CVSS vectors, CWE-306, affected range, credits",
   "type": "public_record",
   "url": "https://cve.threatint.com/CVE/CVE-2026-111322",
   "date": "2026-10-15",
   "tier": "public_regulatory",
   "interest": null,
   "primary": false,
   "checked": "2026-10-16"
  },
  "HACKMD": {
   "title": "Archon OS control API has no authentication by default and binds to all interfaces",
   "type": "researcher",
   "url": "https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default",
   "date": "2026-10-14",
   "tier": "researcher",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "ARCHON-SEC": {
   "title": "Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1)",
   "type": "company",
   "url": "https://raw.githubusercontent.com/coleam00/Archon/v0.11.1/packages/docs-web/src/content/docs/reference/security.md",
   "date": "2026-09-25",
   "tier": "company",
   "interest": "vendor describing its own system",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "ARCHON-0121": {
   "title": "coleam00/Archon CHANGELOG.md at tag v0.12.1: releases 0.12.0 and 0.12.1 of 17 October 2026 (server source and security page read at the same tag)",
   "type": "company",
   "url": "https://raw.githubusercontent.com/coleam00/Archon/v0.12.1/CHANGELOG.md",
   "date": "2026-10-17",
   "tier": "company",
   "interest": "vendor describing its own system",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "sources.HACKMD",
   "old": null,
   "new": "{\"title\": \"Archon OS control API has no authentication by default and binds to all interfaces\", \"type\": \"researcher\", \"url\": \"https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default\", \"date\": \"2026-10-14\", \"tier\": \"researcher\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the reporter's own write-up, which the CVE record cites as its third-party advisory (HackMD, created 14 October 2026), was not cited; it says the finding came from reading the source at v0.11.1, that 'Runtime validation was NOT performed', and that host command execution is 'Not established'"
  },
  {
   "date": "2026-10-21",
   "field": "sources.ARCHON-SEC",
   "old": null,
   "new": "{\"title\": \"Archon documentation page 'Security' (packages/docs-web/src/content/docs/reference/security.md at tag v0.11.1)\", \"type\": \"company\", \"url\": \"https://raw.githubusercontent.com/coleam00/Archon/v0.11.1/packages/docs-web/src/content/docs/reference/security.md\", \"date\": \"2026-09-25\", \"tier\": \"company\", \"interest\": \"vendor describing its own system\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: Archon's own security documentation at the last affected version (tag v0.11.1, 25 September 2026) was not cited; it says Archon 'runs the Claude Code SDK in `bypassPermissions` mode', that 'There is no per-action confirmation step', and that SQLite and solo installs 'have no built-in user authentication'"
  },
  {
   "date": "2026-10-21",
   "field": "sources.ARCHON-0121",
   "old": null,
   "new": "{\"title\": \"coleam00/Archon CHANGELOG.md at tag v0.12.1: releases 0.12.0 and 0.12.1 of 17 October 2026 (server source and security page read at the same tag)\", \"type\": \"company\", \"url\": \"https://raw.githubusercontent.com/coleam00/Archon/v0.12.1/CHANGELOG.md\", \"date\": \"2026-10-17\", \"tier\": \"company\", \"interest\": \"vendor describing its own system\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: later development: Archon released 0.12.0 and 0.12.1 on 17 October 2026, two days after the CVE was published; the changelog names no fix for this flaw and the server source at that tag keeps the same defaults"
  },
  {
   "date": "2026-10-21",
   "field": "title",
   "old": "Archon: unauthenticated control API, bound to all interfaces by default, lets anyone on the network instruct an AI coding agent that runs with bypassPermissions to execute host commands; CVE published 15 October 2026, no fix named",
   "new": "Archon: control API (application programming interface), with its identity check off by default and open on all network interfaces, lets anyone who can reach it send instructions to an AI coding agent that runs without permission prompts; the CVE (Common Vulnerabilities and Exposures) record says this runs host commands, the reporter says that is not established; published 15 October 2026, no fix named",
   "reason": "Found in the editor's source check of 21 October 2026: the API has an authentication gate that is off by default, not none (Archon v0.11.1 auth/config.ts and api.ts as quoted in the reporter's write-up; Archon's security page: web auth 'gates the API server-side' when enabled); and 'execute host commands' is VulnCheck's account in the CVE record, which the reporter's write-up disputes ('Not established. This is not remote code execution on the host'). 'Without permission prompts' is Archon's own description of bypassPermissions ('without interactive confirmation prompts')"
  },
  {
   "date": "2026-10-21",
   "field": "context.autonomy_level_text",
   "old": "The coding agent runs with bypassPermissions and executes commands on the host from messages received over the control API",
   "new": "The coding agent runs in bypassPermissions mode, which Archon's security page says lets it read, write and execute files and run shell commands with no per-action confirmation step; it acts on messages received over the control API",
   "reason": "Found in the editor's source check of 21 October 2026: that the agent 'executes commands on the host from messages received over the control API' is VulnCheck's account, disputed by the reporter's write-up; Archon's security page (v0.11.1) supports the capability: the agent 'can run shell commands' and 'There is no per-action confirmation step'"
  },
  {
   "date": "2026-10-21",
   "field": "context.mandate_context_text",
   "old": "Vulnerability disclosure; no exploitation reported",
   "new": "Vulnerability disclosure found by reading Archon's source code at v0.11.1; the reporter sent no requests to a running instance; no exploitation reported",
   "reason": "Found in the editor's source check of 21 October 2026: the reporter's write-up says 'The requests below are illustrative and were not executed against a live instance' and 'The finding is established by reading the pinned source at release tag v0.11.1'"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 4.0 9.3; CVSS 3.1 9.8)",
   "new": "none reported. Scores in the CVE record, assigned by VulnCheck as CVE Numbering Authority: CVSS (Common Vulnerability Scoring System, a 0 to 10 severity score) version 4.0 base 9.3 and version 3.1 base 9.8, both Critical. The National Vulnerability Database lists both as VulnCheck's and has not scored the record itself (status Deferred). The reporter's write-up labels severity high",
   "reason": "Found in the editor's source check of 21 October 2026: the NVD record (API copy) lists the CVSS 4.0 and 3.1 scores with source disclosure@vulncheck.com, type 'Secondary', vulnStatus 'Deferred'; the CVE.org record carries them in VulnCheck's container; the reporter's write-up badge reads 'severity-high'. The case did not say who assigned the scores"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.as_of",
   "old": "Oct 2026",
   "new": "21 Oct 2026",
   "reason": "Found in the editor's source check of 21 October 2026: later developments checked to 21 October 2026: Archon 0.12.0 and 0.12.1 released 17 October 2026 with no fix named (Archon CHANGELOG.md at v0.12.1); CISA enrichment added to the CVE record 16 October 2026"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints",
   "old": "The /api/* control API has no authentication and binds to 0.0.0.0 by default; the agent runs with bypassPermissions",
   "new": "In a default install the /api/* control API checks no identity: its gate is on only when the operator sets both a DATABASE_URL (a Postgres database) and a BETTER_AUTH_SECRET, which a default SQLite install does not, and the server binds to 0.0.0.0 (all network interfaces) unless HOST is set. The agent runs in bypassPermissions mode, which Archon's security page says means 'There is no per-action confirmation step'. The same page says SQLite and solo installs 'have no built-in user authentication' and tells operators to protect the web interface with basic or form authentication when exposing it publicly",
   "reason": "Found in the editor's source check of 21 October 2026: the API is not without authentication: its identity gate is off by default. The reporter quotes the code, `if (!isApiGateEnabled()) return next();` and isWebAuthEnabled requiring both DATABASE_URL and BETTER_AUTH_SECRET, and says a default SQLite install sets neither; Archon's security page (v0.11.1) says bypassPermissions means 'There is no per-action confirmation step' and that SQLite and solo installs 'have no built-in user authentication', with basic or form authentication advised 'when exposing it publicly'"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints.source_ids",
   "old": "[\"NVD-111322\", \"CVE-111322\"]",
   "new": "[\"NVD-111322\", \"CVE-111322\", \"HACKMD\", \"ARCHON-SEC\"]",
   "reason": "Found in the editor's source check of 21 October 2026: added the reporter's write-up and Archon's security page, which state the gate condition and the vendor's documented posture"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action",
   "old": "The agent executes commands on the host as the Archon user",
   "new": "VulnCheck's CVE record states that attackers' messages lead the agent to execute commands on the host as the Archon user. The reporter's write-up, which the record cites, says this was not run and that host command execution is 'not established'; it says an unauthenticated caller can start workflow runs, send messages into agent conversations and approve or reject the agent's paused actions, with effects that depend on the workflows configured. Archon's own security page says the agent 'can run shell commands' with 'no per-action confirmation step'",
   "reason": "Found in the editor's source check of 21 October 2026: the sources disagree. VulnCheck's CVE record: 'to execute commands on the host as the Archon user'. The reporter's write-up, which that record cites: 'Not established. This is not remote code execution on the host' and 'Runtime validation was NOT performed'. Archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; both accounts now stated and attributed"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.assertion_type",
   "old": "fact",
   "new": "assertion",
   "reason": "Found in the editor's source check of 21 October 2026: the sources disagree. VulnCheck's CVE record: 'to execute commands on the host as the Archon user'. The reporter's write-up, which that record cites: 'Not established. This is not remote code execution on the host' and 'Runtime validation was NOT performed'. Archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; a disputed claim stated by one source is an assertion, not a fact (downgraded, not upgraded)"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.confidence",
   "old": "high",
   "new": "medium",
   "reason": "Found in the editor's source check of 21 October 2026: the sources disagree. VulnCheck's CVE record: 'to execute commands on the host as the Archon user'. The reporter's write-up, which that record cites: 'Not established. This is not remote code execution on the host' and 'Runtime validation was NOT performed'. Archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'; confidence lowered to medium"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.disputed",
   "old": "false",
   "new": "true",
   "reason": "Found in the editor's source check of 21 October 2026: the sources disagree. VulnCheck's CVE record: 'to execute commands on the host as the Archon user'. The reporter's write-up, which that record cites: 'Not established. This is not remote code execution on the host' and 'Runtime validation was NOT performed'. Archon's security page: the agent 'can run shell commands' with 'no per-action confirmation step'"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.source_ids",
   "old": "[\"NVD-111322\", \"CVE-111322\"]",
   "new": "[\"NVD-111322\", \"CVE-111322\", \"HACKMD\", \"ARCHON-SEC\"]",
   "reason": "Found in the editor's source check of 21 October 2026: added the reporter's write-up and Archon's security page, which give the competing account and the agent's documented capability"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026.",
   "new": "State: averted by disclosure. No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: the case did not say the flaw was never run or that CISA rates exploitation as proof of concept. The NVD record (API copy) carries CISA's SSVC (Stakeholder-Specific Vulnerability Categorization) entry of 16 October 2026: Exploitation 'poc', Automatable 'yes', Technical Impact 'total'; the CVE.org record's CISA container tags the reporter's write-up 'exploit'; the write-up says its requests 'were not executed against a live instance'"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome.source_ids",
   "old": "[\"NVD-111322\", \"CVE-111322\"]",
   "new": "[\"NVD-111322\", \"CVE-111322\", \"HACKMD\"]",
   "reason": "Found in the editor's source check of 21 October 2026: added the reporter's write-up, which says no requests were sent"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "CVE-2026-111322, assigned by VulnCheck (reserved and published 15 October 2026), CWE-306 Missing Authentication for Critical Function, CVSS 4.0 9.3 and CVSS 3.1 9.8; affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn",
   "new": "CVE-2026-111322, assigned by VulnCheck as CVE Numbering Authority (reserved and published 15 October 2026); weakness CWE-306 (Common Weakness Enumeration: Missing Authentication for Critical Function); VulnCheck's severity scores CVSS (Common Vulnerability Scoring System) version 4.0 9.3 and version 3.1 9.8, which the National Vulnerability Database lists as VulnCheck's without scoring the record itself (status Deferred); affected versions 0.2.13 through 0.11.1; finder credited as hieuPenguinnn, whose write-up of 14 October 2026 reviewed the source at v0.11.1 and states 'Runtime validation was NOT performed'; the US Cybersecurity and Infrastructure Security Agency's enrichment of 16 October 2026 rates exploitation 'poc' (proof of concept)",
   "reason": "Found in the editor's source check of 21 October 2026: the case did not say who assigned the CVSS scores (VulnCheck; the NVD record lists them as 'Secondary' from disclosure@vulncheck.com, status 'Deferred'), that the finding came from source review only (write-up created 14 October 2026: 'Runtime validation was NOT performed'), or that CISA rates exploitation 'poc'; abbreviations spelled out. Dates, CWE-306, scores, range and finder unchanged and confirmed in the CVE.org record"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"NVD-111322\", \"CVE-111322\"]",
   "new": "[\"NVD-111322\", \"CVE-111322\", \"HACKMD\"]",
   "reason": "Found in the editor's source check of 21 October 2026: added the reporter's write-up for its date and method"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "No fixed version is named in the records",
   "new": "No fixed version is named in the CVE record or in Archon's changelog. Archon released 0.12.0 and 0.12.1 on 17 October 2026; the changelog names no fix for this flaw, and the server source at v0.12.1 still binds to 0.0.0.0 unless HOST is set and still skips the API identity check unless DATABASE_URL and BETTER_AUTH_SECRET are set. Archon's security page at v0.12.1 says 'The console with web auth off and no resolved identity is also the operator'. The CVE record's affected range has not been extended past 0.11.1",
   "reason": "Found in the editor's source check of 21 October 2026: later development: Archon released 0.12.0 and 0.12.1 on 17 October 2026. The changelog at v0.12.1 names no fix for this flaw (0.12.0 notes of a related change 'Solo installs behave as before'); the source at that tag still has `process.env.HOST || '0.0.0.0'` and `if (!isApiGateEnabled()) return next();`; the security page at that tag adds 'The console with web auth off and no resolved identity is also the operator'. The CVE record's range still ends at 0.11.1"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"NVD-111322\", \"CVE-111322\"]",
   "new": "[\"NVD-111322\", \"CVE-111322\", \"ARCHON-0121\"]",
   "reason": "Found in the editor's source check of 21 October 2026: added Archon's changelog and source at tag v0.12.1"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "An agent allowed to run commands without asking is only as safe as the channel that gives it instructions: with no authentication on that channel, anyone who can reach the port holds the agent's command line.",
   "new": "The records show an AI coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: 'anyone who can reach the port holds the agent's command line' restated VulnCheck's account, which the reporter's write-up disputes ('Not established. This is not remote code execution on the host'), and 'no authentication on that channel' omitted that the gate is off by default rather than absent; the interpretation now states both accounts, the counterfactual the reporter makes ('In that configuration the finding does not apply'; loopback 'removes the network reach'), and what the record does not show. The interpretation was not signed, so no signature was cleared"
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"NVD-111322\"]",
   "new": "[\"NVD-111322\", \"HACKMD\", \"ARCHON-SEC\", \"ARCHON-0121\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the interpretation now rests on the reporter's write-up, Archon's security page and the v0.12.1 release as well as the NVD record"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-A1",
   "old": "Mechanism: the /api/* control API accepts messages for the coding agent from any caller with network access, with no authentication. Why it interrupts: if the API established the caller's identity by credential before passing a message to the agent, an unauthenticated attacker's instruction would never reach the agent. Source shows it absent: the record states missing authentication (CWE-306) on the control API.",
   "new": "Mechanism: in a default install the /api/* control API passes messages, workflow runs and approvals for the coding agent from any caller with network access without checking identity; the gate that would check is on only when DATABASE_URL and BETTER_AUTH_SECRET are both set. Why it interrupts: the reporter says that with that gate on, other routes return 401 (unauthorised) and 'In that configuration the finding does not apply'. Source shows it absent: the CVE record states missing authentication (CWE-306, Common Weakness Enumeration: Missing Authentication for Critical Function) on the control API, and the reporter quotes the code `if (!isApiGateEnabled()) return next();`.",
   "reason": "Found in the editor's source check of 21 October 2026: 'with no authentication' overstated: authentication is off by default, not missing (reporter's write-up quoting auth/config.ts and api.ts at v0.11.1); the counterfactual is now the reporter's own ('In that configuration the finding does not apply'). Bucket and confidence unchanged"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-E3",
   "old": "Mechanism: the agent executes host commands from received messages while running with bypassPermissions. Why it interrupts: a confirmation step before command execution would put a human decision between the attacker's message and the command. Source shows it absent only by naming the bypassPermissions mode; the record does not describe what that mode bypasses or show the counterfactual.",
   "new": "Mechanism: the agent acts on received messages in bypassPermissions mode. Why it interrupts: a confirmation step before an action would put a human decision between the attacker's message and the action; no source shows this counterfactual, and the reporter notes that workflow approval gates, where a workflow has them, can themselves be approved by the same unauthenticated caller, so such a step would interrupt only if its approval were authenticated. Source shows it absent: Archon's security page says the agent can 'read, write, and execute files without interactive confirmation prompts' and 'There is no per-action confirmation step'; the CVE record names the bypassPermissions mode.",
   "reason": "Found in the editor's source check of 21 October 2026: the note said the record 'does not describe what that mode bypasses'; Archon's own security page (v0.11.1) does: 'without interactive confirmation prompts' and 'There is no per-action confirmation step'. The reporter's write-up shows the approve route (POST /api/workflows/runs/{runId}/approve) is behind the same disabled gate. Bucket and confidence unchanged"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The records show an AI coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "new": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: abbreviation spelled out at first use."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "new": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: abbreviation spelled out at first use."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "new": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: abbreviation spelled out at first use."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established and depends on the workflows configured, and that turning on web authentication, or binding to the local machine only, removes the exposure. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "new": "The records show an AI (artificial intelligence) coding agent that Archon runs in bypassPermissions mode, which Archon's own security page says means no per-action confirmation step, behind a control API (application programming interface) that in a default install checks no identity and listens on all network interfaces. VulnCheck's CVE (Common Vulnerabilities and Exposures) record reads this as letting anyone who can reach the port run commands on the host. The reporter, who found it by reading the source and sent no requests, says the agent can be driven but that host command execution is not established, that what a driven run does depends on the workflows and agent configured, and that turning on web authentication makes the finding not apply, while binding to the local machine only removes the network reach. The records show no exploitation, no test against a running instance, and no fix as of 21 October 2026.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the reporter's write-up separates the two: 'severity of a driven run depends on the workflows and agent configured'; with web authentication on the finding does not apply, while binding to the loopback interface 'removes the network reach even though the gate stays disabled' (HackMD)."
  },
  {
   "date": "2026-10-21",
   "field": "outcome.state",
   "old": "averted_by_disclosure",
   "new": "pending",
   "reason": "Editor's call H1 of 21 October 2026 (accepted as amended, pull request #79): no fix has shipped in a published release, so the outcome is not yet known; 'averted by disclosure' claimed an outcome that has not happened."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier",
   "old": "disclosure_uncorroborated",
   "new": "disclosure_corroborated",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier_text",
   "old": "CVE record assigned by VulnCheck and recorded in NVD; no maintainer advisory or fix found in the sources",
   "new": "CVE record assigned by VulnCheck and recorded in NVD; corroborated by Archon's own security page and code, which show the identity check off by default and the agent running without per-action confirmation; host command execution is disputed by the reporter; no maintainer advisory or fix",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): tier text updated to name the corroborating records."
  },
  {
   "date": "2026-10-21",
   "field": "status",
   "old": "provisional",
   "new": "confirmed",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (no maintainer advisory or fix in the sources; no exploitation reported)",
   "new": "Confirmed (corroborated by Archon's own documentation and code; host command execution disputed; no fix; no exploitation reported)",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case."
  },
  {
   "date": "2026-10-22",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026.",
   "new": "State: pending (no fix has shipped). No exploitation reported in the sources. The flaw has not been shown running: the reporter found it by reading the source and sent no requests. The US Cybersecurity and Infrastructure Security Agency's (CISA) enrichment of the CVE record (16 October 2026) nonetheless rates exploitation 'poc' (a public proof of concept) and tags the reporter's write-up as an exploit. As of 21 Oct 2026.",
   "reason": "Follows the editor's call H1 of 21 October 2026 (outcome 'pending' where no fix has shipped): the field's state label had not been updated with the outcome; the rest of the field is unchanged."
  },
  {
   "date": "2026-10-22",
   "field": "outcome.regime_consequence",
   "old": "CVE-2026-111322; no fixed version named",
   "new": "none",
   "reason": "Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a CVE, an advisory, a score or a fix is not one. The CVE and fix details are already in the Evidence and Recovery fields, so nothing is lost. Found while drafting this case's letters, 22 October 2026."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Archon].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-16",
 "last_reviewed": "2026-10-22",
 "reviewed_by": null,
 "derived_by": "agent"
}